pi-roundtable 0.8.0 → 0.9.1

package/src/core/runtime/reader-history.ts

@@ -0,0 +1,129 @@
+import type {
+	ContextWithSystemEvent,
+	SessionManager,
+} from "@earendil-works/pi-coding-agent";
+import { SYSTEM_PRINCIPAL } from "../identity/principal-store.ts";
+import { MEMORY_TOOLS } from "../modules/memory/owner-memory.ts";
+import { guardHidesPrivateExchange } from "./extensions/private-memory.ts";
+import { SCOPE_ENTRY } from "./session-scope.ts";
+
+/** A turn's reader and whether its request carried private memory, retained across compaction. */
+export const MEMORY_TURN_ENTRY = "roundtable-memory-turn";
+interface ReaderRecord {
+	reader: string;
+	privateMemory: boolean;
+}
+type Messages = ContextWithSystemEvent["messages"];
+const MEMORY = new Set<string>(MEMORY_TOOLS);
+
+/** Persist before prompting; the returned marker records later memory exchanges or memory-loaded workers. */
+export function recordMemoryTurn(
+	manager: Pick<SessionManager, "appendCustomEntry">,
+	reader: string,
+	privateMemory: boolean,
+): () => void {
+	const turnId = crypto.randomUUID();
+	manager.appendCustomEntry(MEMORY_TURN_ENTRY, {
+		turnId,
+		reader,
+		privateMemory,
+	});
+	return () => {
+		if (privateMemory) return;
+		privateMemory = true;
+		manager.appendCustomEntry(MEMORY_TURN_ENTRY, {
+			turnId,
+			reader,
+			privateMemory,
+		});
+	};
+}
+
+/** Includes immediate validation/truncation failures and calls an aborted turn left unanswered. */
+export function carriesMemory(
+	message: ContextWithSystemEvent["messages"][number],
+): boolean {
+	if (message.role === "assistant")
+		return message.content.some(
+			(part) => part.type === "toolCall" && MEMORY.has(part.name),
+		);
+	if (message.role !== "toolResult") return false;
+	return (
+		MEMORY.has(message.toolName) ||
+		(typeof message.details === "object" &&
+			message.details !== null &&
+			"privateTo" in message.details)
+	);
+}
+
+function readerRecord(data: unknown): ReaderRecord | undefined {
+	if (typeof data !== "object" || data === null) return undefined;
+	if (
+		!("reader" in data) ||
+		!("privateMemory" in data) ||
+		typeof data.reader !== "string" ||
+		data.reader.length === 0 ||
+		typeof data.privateMemory !== "boolean"
+	)
+		return undefined;
+	return { reader: data.reader, privateMemory: data.privateMemory };
+}
+
+/**
+ * Whether bridge's raw branch would replay another reader's private turn, including retained
+ * prompts/reasoning and compacted entries. Explicit privateTo results still restrict the reader,
+ * and SYSTEM is a reader of its own. Untagged memory before the first scope record is no one's
+ * in this public form; later unrecorded exchanges fail closed.
+ */
+export function bridgeHistoryHidesMemory(
+	branch: ReturnType<SessionManager["getBranch"]>,
+	reader: string | undefined,
+): boolean {
+	return bridgeHistoryHidesMemoryFor(branch, reader);
+}
+
+/**
+ * The core's own check, which public `bridgeHistoryHidesMemory` leaves its attribution knob out
+ * of: untagged memory before the first scope record keeps the primary-owner legacy attribution,
+ * and SYSTEM counts as primary owner when `primaryOwner` is supplied.
+ */
+export function bridgeHistoryHidesMemoryFor(
+	branch: ReturnType<SessionManager["getBranch"]>,
+	reader: string | undefined,
+	primaryOwner?: string,
+): boolean {
+	const normalized = (who: string | undefined) =>
+		who === SYSTEM_PRINCIPAL && primaryOwner !== undefined ? primaryOwner : who;
+	const current = normalized(reader);
+	let record: ReaderRecord | undefined;
+	let messages: Messages = [];
+	let legacy = true;
+	const hidden = () => {
+		const whose = normalized(record?.reader);
+		const carried = record?.privateMemory || messages.some(carriesMemory);
+		if (record && carried && whose !== current) return true;
+		return guardHidesPrivateExchange(messages, {
+			shared: true,
+			reader: current,
+			legacyOwner: record ? whose : legacy ? primaryOwner : undefined,
+			turnReader: whose,
+		});
+	};
+	for (const entry of branch) {
+		if (
+			entry.type === "custom" &&
+			(entry.customType === MEMORY_TURN_ENTRY ||
+				entry.customType === SCOPE_ENTRY)
+		) {
+			if (hidden()) return true;
+			messages = [];
+			if (entry.customType === SCOPE_ENTRY) legacy = false;
+			else {
+				record = readerRecord(entry.data);
+				// A corrupt record cannot establish safe ownership of a private turn.
+				if (!record) return true;
+			}
+		} else if (entry.type === "message") messages.push(entry.message);
+	}
+	return hidden();
+}

package/src/core/runtime/runtime-plugin.ts

@@ -7,12 +7,24 @@ import type {
 } from "../contract/runtime.ts";
 import type { ChannelKey } from "../domain/conversation.ts";
 import type { InterimTextMode } from "../domain/interim.ts";
+import type { IdentityService } from "../identity/identity-service.ts";
 import type { OwnerIdentity } from "../identity.ts";
+import type { PromptScope } from "../interactions/prompts.ts";
 import { AGENT_BRIEF, EffortJudge } from "../judging/effort-judge.ts";
-import type { ModelRef, ThinkingLevel } from "../models.ts";
+import {
+	formatModelRef,
+	type ModelRef,
+	type ThinkingLevel,
+} from "../models.ts";
 import type { PluginContext, RoundtablePlugin } from "../plugin.ts";
-import { RUNTIME } from "../services.ts";
+import { CONVERSATIONS, IDENTITY, RUNTIME } from "../services.ts";
 import type { Speaker } from "../speakers.ts";
+import {
+	BRIDGE_MEMORY_FIX,
+	bridgeMemoryProblem,
+	liveBridgeRefusal,
+	onClaudeBridge,
+} from "./bridge-guard.ts";
 import { PendingConfirmationStore } from "./pending-confirmation-store.ts";
 import { PiAgentRuntime } from "./pi-agent-runtime.ts";
 
@@ -63,6 +75,10 @@ export interface RuntimePluginOptions {
 	interimText?: InterimTextMode;
 	/** An intermediate text this long or longer is posted as an ordinary message; default 400. */
 	interimPrimaryChars?: number;
+	/** Whether the host keeps each person's memory; bridge turns then check private history. */
+	memory?: boolean;
+	/** Why the configuration lets several people speak in a shared conversation, as `configuredCrowd` says. */
+	crowd?: string;
 }
 
 /**
@@ -79,18 +95,36 @@ export function runtimePlugin(
 		PendingConfirmationStore.attach(context.database()),
 ): RoundtablePlugin {
 	let runtime: AgentRuntime | undefined;
+	let identity: IdentityService | undefined;
+	let warn: ((message: string) => void) | undefined;
+	// Admission is a startup risk warning, not proof that this conversation holds private history.
+	const bridgeRefusal = liveBridgeRefusal({
+		memory: options.memory,
+		crowd: options.crowd,
+		identity: () => identity,
+		primary: options.owner.id,
+	});
 	return {
 		name: RUNTIME_PLUGIN,
 		migrations: PendingConfirmationStore.migrations(),
 		provides: [RUNTIME],
 		preflight: async () => {
+			if (onClaudeBridge(options.model)) {
+				const why = await bridgeRefusal();
+				if (why)
+					warn?.(
+						`${bridgeMemoryProblem(formatModelRef(options.model), why)} ${BRIDGE_MEMORY_FIX}`,
+					);
+			}
 			await runtime?.preflight?.();
 		},
 		setup: async (context) => {
-			const { logger, providers } = context;
+			const { logger, providers, services } = context;
+			identity = services.find(IDENTITY);
+			warn = (message) => logger.warn({}, message);
 			const heldActions = await openHeldActions(context);
-			const prompts = (channel: ChannelKey, speaker?: Speaker) =>
-				context.surfaces.prompts(channel, speaker);
+			const prompts = (channel: ChannelKey, scope?: PromptScope | Speaker) =>
+				context.surfaces.prompts(channel, scope);
 			const agents = () => options.agents?.current();
 			const running: AgentRuntime = providers.filled.has("runtime")
 				? providers.runtime(
@@ -108,6 +142,17 @@ export function runtimePlugin(
 					)
 				: new PiAgentRuntime({
 						owner: options.owner,
+						// Read at every turn that names no conversation, after every plugin set up.
+						conversationOf: async (key) => {
+							const record = await services.find(CONVERSATIONS)?.get(key);
+							if (!record) return undefined;
+							return record.visibility === "private" &&
+								record.principalId !== undefined
+								? { visibility: "private", principalId: record.principalId }
+								: { visibility: "shared" };
+						},
+						principalOf: async (id) => services.find(IDENTITY)?.principal(id),
+						memory: options.memory === true,
 						sessions: context.sessions,
 						agentDir: options.agentDir,
 						modelRuntime: options.modelRuntime,
@@ -123,6 +168,7 @@ export function runtimePlugin(
 						}),
 						confirmations: heldActions,
 						toolTiers: context.toolTiers,
+						stopping: () => context.queue.closed,
 						get agents() {
 							return agents();
 						},

package/src/core/runtime/runtime-types.ts

@@ -7,20 +7,24 @@ import type {
 import type { AgentSessions, LoadedSkill } from "../contract/runtime.ts";
 import type { ChannelKey } from "../domain/conversation.ts";
 import type { InterimTextMode } from "../domain/interim.ts";
-import type { OwnerPrompts } from "../domain/owner-prompts.ts";
+import type { TurnConversation } from "../domain/ports.ts";
+import type { Principal } from "../identity/principal-store.ts";
 import type { OwnerIdentity } from "../identity.ts";
+import type { PromptScope, Prompts } from "../interactions/prompts.ts";
 import type { Logger } from "../log.ts";
 import type { ThinkingLevel, ThinkingPicker } from "../models.ts";
 import type { LinkedSessions } from "../plugin.ts";
 import {
 	planOrder,
 	type SessionContext,
+	type SessionConversation,
 	type SessionPlan,
 	type SessionTool,
 } from "../sessions.ts";
-import type { Speaker } from "../speakers.ts";
 import type { ToolTiers } from "../tool-tiers.ts";
+import type { MemoryDraws } from "./extensions/private-memory.ts";
 import type { PendingConfirmationStore } from "./pending-confirmation-store.ts";
+import { scopedCalls } from "./tool-call-scope.ts";
 
 export type TurnMessage = Extract<
 	AgentSessionEvent,
@@ -33,8 +37,19 @@ export type CompactionEnd = Extract<
 export const TRANSCRIPT_ENTRY_CHARS = 1000;
 
 export interface PiAgentRuntimeOptions {
-	/** Who the conversations serve, as prompts and tool results name them. */
-	owner: OwnerIdentity;
+	/**
+	 * The primary owner, by their principal id: their conversations' prompts and tool results name
+	 * them as configured, and the host's own turns address them.
+	 */
+	owner: OwnerIdentity & { id: string };
+	/**
+	 * The host's record of a conversation, read at every turn that names none, so a record changed
+	 * while its session is open counts, and when its transcript is read; without it, or without a
+	 * record, the conversation is as its open session or its history was made, else shared.
+	 */
+	conversationOf?: (key: ChannelKey) => Promise<TurnConversation | undefined>;
+	/** A principal's name and pronouns, which a private conversation's tool descriptions use. */
+	principalOf?: (id: string) => Promise<Principal | undefined>;
 	agentDir: string;
 	/** Shared by the host's sessions, so logins refresh in one place. */
 	modelRuntime: ModelRuntime;
@@ -56,17 +71,23 @@ export interface PiAgentRuntimeOptions {
 	/** The agent server's sessions: their shared workspace, model, and skills. */
 	agents?: AgentSessions;
 	/**
-	 * Cards the owner answers in a channel, for interactive turns; undefined for a channel that
-	 * cannot show them. Without it every held action waits for their next message.
+	 * The prompts of a channel for an interactive turn's scope, made from its speaker and its
+	 * conversation's visibility; undefined for a channel that cannot show them. Without it every
+	 * held action waits for a message that approves it.
 	 */
-	prompts?: (
-		channel: ChannelKey,
-		speaker?: Speaker,
-	) => OwnerPrompts | undefined;
+	prompts?: (channel: ChannelKey, scope?: PromptScope) => Prompts | undefined;
 	/** The lowest tier that may use each tool; the default names the core's tools and leaves the rest to the owner. */
 	toolTiers?: ToolTiers;
 	/** A run that takes longer, not counting time spent waiting on the owner's cards, is aborted and reported as failed. */
 	turnTimeoutMs?: number;
+	/**
+	 * How long a turn that was aborted, by its timeout or a stop, gets to end before its session is
+	 * disposed of and the turn is reported failed; default 15 seconds. A model that ignores the
+	 * abort would otherwise hold the turn, and the shutdown drain, for ever.
+	 */
+	turnAbortGraceMs?: number;
+	/** Whether the host is shutting down: a turn or a task is then refused before it starts. */
+	stopping?: () => boolean;
 	/**
 	 * Whether a turn given a place for interim posts shows the text it writes before its final
 	 * answer as it goes; default "on". "off" posts only the final reply.
@@ -76,6 +97,8 @@ export interface PiAgentRuntimeOptions {
 	interimPrimaryChars?: number;
 	/** How long a new session waits for its MCP tools to register. */
 	mcpConnectTimeoutMs?: number;
+	/** Defaults to true: bridge shared turns refuse raw private exchanges inaccessible to the reader. */
+	memory?: boolean;
 }
 
 export type { AgentSessions, LoadedSkill };
@@ -91,12 +114,14 @@ export interface CoreExtensions {
 	confirmationGate: ExtensionFactory;
 	askUser: ExtensionFactory;
 	selfCompactGuard: ExtensionFactory;
+	privateMemory: ExtensionFactory;
 	activeTools: ExtensionFactory;
 }
 
 /**
  * A session's extensions in load order: the tools phase, the core's attachment, gate, ask-user,
- * and compact guard, the compactor, the MCP phase, and active-tools last, so its
+ * and compact guard, the compactor, the MCP phase, the memory projection, so each request is
+ * projected after every other extension changed it, and active-tools last, so its
  * before_agent_start handler runs after every other extension's.
  */
 export function sessionExtensions(
@@ -107,7 +132,9 @@ export function sessionExtensions(
 	const contributed = (tools: readonly SessionTool[]) =>
 		tools.flatMap((tool) => {
 			const factory = tool.snapshot().factory(session);
-			return factory ? [{ name: tool.name, factory }] : [];
+			return factory
+				? [{ name: tool.name, factory: scopedCalls(factory) }]
+				: [];
 		});
 	return [
 		...contributed(plan.tools),
@@ -117,6 +144,7 @@ export function sessionExtensions(
 		{ name: "self-compact-guard", factory: core.selfCompactGuard },
 		...contributed(plan.compaction ? [plan.compaction] : []),
 		...contributed(plan.mcp),
+		{ name: "private-memory", factory: core.privateMemory },
 		{ name: "active-tools", factory: core.activeTools },
 	];
 }
@@ -129,4 +157,12 @@ export interface ChannelSession {
 	revisions: string;
 	/** The skills an agent session was built with, as skillsKey. */
 	skills: string;
+	/** Whom the session's conversation serves, fixed when it was built. */
+	conversation: SessionConversation;
+	/** Whom its tool descriptions address. */
+	addressee: OwnerIdentity;
+	/** Whose memory its turns read, as resolved when it was built; a worker beside it keeps the same. */
+	memory: SessionContext["memory"];
+	/** Its tool calls running now, which a task that reads the reader's memory marks as drawing on it. */
+	draws: MemoryDraws;
 }

package/src/core/runtime/session-conversation.ts

@@ -0,0 +1,143 @@
+import type { ChannelKey } from "../domain/conversation.ts";
+import type { TurnConversation, TurnRequest } from "../domain/ports.ts";
+import {
+	type Principal,
+	SYSTEM_PRINCIPAL,
+} from "../identity/principal-store.ts";
+import { addresseeOf, type OwnerIdentity } from "../identity.ts";
+import type { SessionConversation } from "../sessions.ts";
+import { addressee, type Speaker, THE_SPEAKER } from "../speakers.ts";
+import type { PiAgentRuntimeOptions } from "./runtime-types.ts";
+
+/**
+ * Whom a conversation serves as something says so: an agent's is shared; another is as the turn
+ * says, else as the host's record says; undefined when neither does.
+ */
+export async function namedConversation(
+	key: ChannelKey,
+	request: Pick<TurnRequest, "agent" | "conversation"> | undefined,
+	options: Pick<PiAgentRuntimeOptions, "conversationOf">,
+): Promise<TurnConversation | undefined> {
+	if (request?.agent) return { visibility: "shared" };
+	return request?.conversation ?? (await options.conversationOf?.(key));
+}
+
+/**
+ * Whom a new session's conversation serves: as the turn or the host's record names it, else
+ * shared, never the owner's by default. A private one's person is looked up for their name and
+ * pronouns.
+ */
+export async function sessionConversation(
+	key: ChannelKey,
+	request: Pick<TurnRequest, "agent" | "conversation"> | undefined,
+	options: Pick<PiAgentRuntimeOptions, "conversationOf" | "principalOf">,
+): Promise<SessionConversation> {
+	const given = await namedConversation(key, request, options);
+	if (given?.visibility !== "private") return { visibility: "shared" };
+	const principal = await options.principalOf?.(given.principalId);
+	return {
+		visibility: "private",
+		principalId: given.principalId,
+		...(principal ? { principal } : {}),
+	};
+}
+
+/** Whether the turn names its conversation otherwise than the session was made for, so it is rebuilt. */
+export function conversationChanged(
+	session: SessionConversation,
+	given: TurnConversation | undefined,
+): boolean {
+	if (!given) return false;
+	if (given.visibility !== session.visibility) return true;
+	return (
+		given.visibility === "private" &&
+		session.visibility === "private" &&
+		given.principalId !== session.principalId
+	);
+}
+
+/**
+ * Whom a session's tool descriptions address: the primary owner as configured, so their own
+ * conversations read as in 0.8; another private conversation's person by their name and
+ * pronouns; and the speaker, unnamed, in a shared one or a private one of someone the host has
+ * no name for.
+ */
+export function sessionAddressee(
+	conversation: SessionConversation,
+	owner: OwnerIdentity & { id: string },
+): OwnerIdentity {
+	if (conversation.visibility !== "private") return THE_SPEAKER;
+	if (conversation.principalId === owner.id) return owner;
+	const named = namedPrincipal(conversation);
+	return named ? addresseeOf(named) : THE_SPEAKER;
+}
+
+/**
+ * A private conversation's person, when the host knows them by a name: one carried over from 0.8
+ * may be named by their id alone until someone names them, and an id is no name to address.
+ */
+export function namedPrincipal(
+	conversation: SessionConversation,
+): Principal | undefined {
+	if (conversation.visibility !== "private") return undefined;
+	const { principal } = conversation;
+	return principal && principal.displayName !== principal.id
+		? principal
+		: undefined;
+}
+
+/**
+ * Whom a turn's approvals and answers name: a private conversation's person as its session
+ * addresses them; the host's own turns and the primary owner as the owner; anyone else, a
+ * second owner too, by their name.
+ */
+export function turnAddressee(
+	speaker: Speaker | undefined,
+	session: { conversation: SessionConversation; addressee: OwnerIdentity },
+	owner: OwnerIdentity & { id: string },
+): OwnerIdentity {
+	const { conversation } = session;
+	if (
+		speaker &&
+		conversation.visibility === "private" &&
+		speaker.principalId === conversation.principalId &&
+		session.addressee !== THE_SPEAKER
+	)
+		return session.addressee;
+	const own =
+		!speaker ||
+		speaker.principalId === owner.id ||
+		speaker.principalId === SYSTEM_PRINCIPAL;
+	return own ? owner : addressee({ ...speaker, tier: "member" }, owner);
+}
+
+/**
+ * Whose memory a session's running turn reads: a private conversation's person's, whoever speaks
+ * in it, and in a shared one the speaker's; no one's for the host's own turns there, nor while
+ * no turn runs.
+ */
+export function memoryReader(
+	conversation: SessionConversation,
+	speaker: Speaker | undefined,
+): string | undefined {
+	if (conversation.visibility === "private") return conversation.principalId;
+	if (!speaker || speaker.principalId === SYSTEM_PRINCIPAL) return undefined;
+	return speaker.principalId;
+}
+
+/**
+ * Why a turn may not run in the session's conversation: someone other than its person speaking
+ * in a private one. The host's own turns may.
+ */
+export function refusedSpeaker(
+	conversation: SessionConversation,
+	speaker: Speaker,
+): string | undefined {
+	if (conversation.visibility !== "private") return undefined;
+	if (
+		speaker.principalId === conversation.principalId ||
+		speaker.principalId === SYSTEM_PRINCIPAL
+	)
+		return undefined;
+	return `the conversation is private to ${conversation.principalId}, so a turn of ${speaker.principalId} may not run in it`;
+}